PHP2Shell is the name given to two critical flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. On an unpatched server, an attacker can send a crafted web request and run their own code on the machine, without logging in and without needing a bug in your website. PHP powers WordPress, WooCommerce, Laravel, Magento and most shared hosting, so if your site runs on PHP, this applies to you.
The fix is simple to describe: your server must run PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, or a vendor build that includes the backported fix. Attacks have already been seen in the wild, so if nobody has confirmed the update on your site since 21 October 2026, treat it as urgent.
What happened
The PHP project pre-announced a security release on 20 October 2026, saying it would address "two critical vulnerabilities, both rated CVSS v4.0 9.2" (the scale tops out at 10). The fixed releases followed on 21 October, according to the PHP news archive. Security firm watchTowr reports that details leaked online before the planned disclosure time.
In plain terms, the two bugs are:
| CVE | What goes wrong | Why it matters |
|---|---|---|
| CVE-2026-109618 | PHP's out-of-memory handling can interrupt a request while internal data is only half set up, and the clean-up step then trusts that broken data | Can be triggered by an unauthenticated POST request before your website's own code even runs |
| CVE-2026-109619 | Internal state from one request can survive after its memory is freed, and the next request handled by the same worker may use it | Reachable through features such as session upload progress, which is on by default |
The PHP project says the flaws affect "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed," and that it considers the risk highest for mod_php. Datadog Security Labs notes that any PHP script can be the entry point, even one that only prints a response, and that the malicious request never needs to reach your application code. That is why a login page, a security plugin or a strong admin password does not protect you here.
Is it being exploited?
Yes. Help Net Security reported that Amazon's threat intelligence team saw an exploitation attempt on 17 October 2026, before the public release. watchTowr says its honeypots observed exploitation of both CVEs on 21 October, and Datadog reported "multiple reports of active exploitation in the wild" alongside broad, untargeted scanning.
Untargeted scanning is the key point for small businesses. Attackers are not choosing big brands; they are sweeping the internet for any server that answers with an old PHP version. A local clinic, an estate agent's listings site or a small online shop is exactly what these scans find.
Which PHP versions are safe
According to the PHP project and the version tables published by Datadog and the Dutch NCSC:
| PHP branch | Vulnerable | Fixed in |
|---|---|---|
| 8.5 | Before 8.5.12 | 8.5.12 |
| 8.4 | Before 8.4.27 | 8.4.27 |
| 8.3 | Before 8.3.36 | 8.3.36 |
| 8.2 | Before 8.2.35 | 8.2.35 |
| 8.1, 8.0, 7.4 | Yes | No official release; source backports only |
| 7.3 and older | Yes | No fix; upgrade required |
The PHP project states that "PHP 8.1 and older no longer receive updates from the PHP project," though it has published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves. Some Linux distributions and long-term support vendors ship their own patched builds, sometimes without changing the version number, so check your host's or vendor's advisory rather than relying on the number alone.
Also note that PHP 8.2 reaches end of life on 31 December 2026, per php.net. If you are upgrading anyway, moving to 8.4 or 8.5 saves you a second migration in eight weeks.
How to check your website's PHP version
Datadog and watchTowr both warn about one common trap: the php -v command on a server's command line can report a different version from the one that actually serves your website through PHP-FPM or Apache. Check the version your web server is really using.
- Managed or shared hosting (most small businesses): log in to your hosting panel (cPanel, Plesk, hPanel, CyberPanel and similar) and look for "PHP version" or "Select PHP version". Then check your host's status page or email for a PHP2Shell notice, and ask support directly: "Has the PHP running my site been patched for CVE-2026-109618 and CVE-2026-109619?"
- WordPress: go to Tools > Site Health > Info > Server. It shows the PHP version that runs WordPress.
- Your own server or VPS: create a temporary file containing
<?php phpinfo();, open it in a browser, note the version, then delete the file straight away. Compare the result with the table above, or with your distribution's security notice if it backports fixes.
What to do today
1. Patch or upgrade PHP
This is the only complete fix. On managed hosting, your host should handle it, but get written confirmation. On a VPS, install your distribution's updated PHP packages and restart PHP-FPM or Apache so every worker loads the new version. If you are on 8.1 or older, plan an upgrade to a supported branch and test your themes and plugins first, ideally on a staging copy.
2. Use temporary mitigations only as a stopgap
The PHP project published workarounds for systems that cannot be patched immediately, while stressing that they "reduce exposure... but do not make an installation safe." They include:
- Setting
session.upload_progress.enabled=0in php.ini or the FPM pool, then restarting every worker - Setting
fatal_error_backtraces=0on PHP 8.5 - Lowering
post_max_sizeand enforcing request-size limits at the web server or proxy
Security researchers disagree on how much these help. watchTowr says ini-file mitigations should be treated as ineffective, and Datadog says they "don't fully protect you." Use them to buy hours, not weeks.
3. Put a shield in front
Help Net Security reports that Cloudflare deployed initial web application firewall rules for PHP2Shell, available to all customers including the free plan. A WAF reduces risk while you patch; it does not replace patching.
4. Take the site down properly if you must
If you need to take a site offline to fix it, do it in a way that protects your search rankings. Google's John Mueller advised on Bluesky: "If you're taking PHP sites down to schedule time to deal with 'unplanned updates', use HTTP 503 instead of letting responses time out / 404 / 500. You can do this outside of PHP / point DNS elsewhere / CDN." A 503 tells Google the outage is temporary, which is far safer than a site that suddenly returns errors.
5. Check for signs of compromise
Because attacks started before the patch existed, an updated server could still have been hit earlier. Look for unfamiliar admin users, new or recently modified PHP files in upload folders, unexpected scheduled tasks, spam pages appearing in Google, or hosting alerts about high CPU or outbound email. If anything looks wrong, restore from a clean backup taken before 17 October and change all passwords and keys.
Why this keeps happening to small business sites
Most small business websites are launched and then left alone. The design still looks fine, so nobody notices that the server underneath is running a PHP version that stopped getting security fixes years ago. PHP2Shell is a reminder that a website is software, and software needs maintenance in the same way a shop needs locks.
A sensible routine is to review your PHP version and plugin updates monthly, keep off-site backups you have actually tested, and have someone responsible for reacting within a day when a critical advisory like this lands. If that person does not exist in your business today, our hosting and maintenance service covers exactly this, and our guide to website speed and Core Web Vitals explains why newer PHP versions tend to make sites faster too.
Frequently asked questions
Is my WordPress site affected by PHP2Shell?
If it runs on a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and your host has not applied a backported fix, yes. The flaw is in PHP itself, so it does not matter which theme or plugins you use. Check Tools > Site Health > Info > Server and confirm with your host.
Will a security plugin protect me?
No. According to Datadog's analysis, the malicious request is processed by PHP before your WordPress or application code runs, so plugins never see it. Patching PHP, plus a web application firewall in front of the server, is what helps.
My host says PHP is updated but the version number looks old. Is that a problem?
Not necessarily. Some Linux distributions and hosting vendors backport security fixes without changing the upstream version number. Ask your host to confirm in writing that the build serving your site includes the fixes for CVE-2026-109618 and CVE-2026-109619.
Will taking my site offline to patch it hurt my Google rankings?
A short, well-handled outage should not. Google's John Mueller recommends returning an HTTP 503 status during planned downtime rather than letting pages time out or return 404 or 500 errors.
The bottom line
PHP2Shell is serious because it needs no login, no plugin bug and no mistake on your part, only an unpatched server. Confirm your PHP version today, get the patch applied, and check for signs of earlier compromise. If you would like us to check your site, apply the update safely or take over ongoing maintenance, get in touch with Mistique Designs and we will review it with you.